An Interview with Aric K. Perminter
Today, more than ever, new products and software are under constant attack from malicious actors. This reality has made the role of the C-level cybersecurity executive, including Chief Information Security Officers and Chief Product Security Officers, one of the most critical lines of defense.
To better understand what it takes to succeed in these roles today, we spoke with Aric about leadership, emerging threats, and building a successful career in cybersecurity.
The cybersecurity industry feels especially dynamic right now. What are three things that excite you most about the industry?
The potential of AI.
When implemented correctly, AI-enabled threat detection systems can predict emerging attacks and notify administrators of potential breaches in near real time. AI-enabled GRC platforms can also generate predictive, multi-panel dashboards simply by selecting a data element, without requiring manual report creation.
Quantum cryptography.
To build truly usable systems, quantum cryptography may need to be combined with non-quantum elements. Those non-quantum components could introduce vulnerabilities in ways that theorists have not yet fully anticipated.
The role of GRC in ESG.
ESG and GRC share a foundational element: governance. GRC establishes rights, objectives, and accountability structures, then focuses on managing uncertainty and risk. When integrated into ESG reporting, GRC enables organizations to credibly report progress against ESG goals. The GRC capability model centers on learning, aligning, performing, and reviewing, all of which support responsible and transparent ESG reporting.
What concerns you most about the cybersecurity industry today, and what can be done to address those concerns?
Cybersecurity breaches.
As technology evolves, so do attack methods. Organizations must stay current with both threats and defenses. This includes adopting multi-factor authentication, strong password policies, encryption for stored data, endpoint security solutions, and regular vulnerability scanning to identify risks before they escalate.
Immature governance models.
Integrated Risk Management (IRM) is a collaborative, organization-wide approach that improves risk visibility and decision-making. IRM brings together security, compliance, IT, and other functions to manage risk holistically. Strategy-first IRM solutions help organizations identify, assess, prioritize, and address risks in alignment with business objectives.
ESG risk exposure.
GRC plays a critical role in ESG initiatives by identifying risks that could undermine environmental, social, or governance commitments. These risks include financial loss, regulatory exposure, and reputational damage.
Looking ahead, are there emerging threats companies should start preparing for now?
The human factor remains a major concern. The shift to remote and hybrid work has created new attack surfaces and opportunities for exploitation.
For non-technical users, are there warning signs that something may be wrong?
Common indicators include unusually fast battery drain, loud or persistent device fan activity, and consistently slow website performance. People often reboot and move on, but these symptoms can indicate underlying threats that still need investigation.
What are the most common mistakes you see that make organizations vulnerable to ransomware?
Poor patch management and immature data storage strategies are two of the biggest issues. This includes lack of encryption and inconsistent or unreliable backup practices.
As attackers increasingly target software embedded in products like vehicles and robotics, what should manufacturers do to uncover vulnerabilities earlier?
I generally align with Microsoft’s recommended development security practices. The most critical areas include training, clearly defining security requirements, performing threat modeling, using approved tools, and conducting both static and dynamic security testing. Penetration testing and a standardized incident response process are also essential.
What are the five things someone needs to build a successful career as a cybersecurity executive today?
Adequate budget.
Even the most talented leaders cannot succeed with chronically underfunded security programs.
A strong peer network.
Cybercriminals collaborate across boundaries. Security leaders must do the same.
Clear communication.
Consistent, clear communication enables better and faster decision-making.
Professionalism.
Professionalism outlasts authority. Bullies fade over time, while professionals are trusted and invited back.
Empathy.
The most effective leaders understand and relate to others. Empathy enables better support, stronger teams, and better outcomes.
If you could inspire a movement to create the most good for the most people, what would it be?
I would create a nonprofit that trains formerly incarcerated individuals to become risk analysts. These professionals could provide low-cost risk assessments to state, local, and educational institutions that are often underfunded for mission-critical security services. We are currently working toward launching something called the Risk Analysis Professional (RAP) Council.
How can readers follow your work?
You can find me on X at @aricperminter and on LinkedIn at linkedin.com/in/aricperminter.